Harden first-release validation and dependency hygiene

docs/conformance-matrix.md

@@ -4,16 +4,28 @@
 | --- | --- | --- | --- |
 | TAL syntax and TA public-key binding | RFC 8630 §2 | `src/validation/from_tal.rs`, `src/model/ta.rs` | parser and synthetic integration tests |
 | TA and issued CA profile/signature/resource checks | RFC 6487 §4 | `src/validation/`, `src/model/` | profile unit tests and synthetic integration tests |
-| Manifest, manifest file hashes, CRL freshness, and ROA checks | RFC 6486, RFC 6487, RFC 6482 | `src/validation/`, `src/model/` | RRDP unit tests and self-contained `tests/synthetic_docker_e2e.sh` |
+| Manifest profile, file hashes, and freshness checks | RFC 9286 §§4, 6 | `src/model/manifest.rs`, `src/validation/manifest.rs` | manifest profile and validation unit tests |
+| CRL profile and freshness checks | RFC 6487 §5 | `src/model/crl.rs`, `src/validation/` | CRL profile and validation tests |
+| ROA profile and payload checks | RFC 9582 §§3–4 | `src/model/roa.rs`, `src/validation/` | ROA profile tests and synthetic CSV assertions |
+| ASPA profile and provider-list checks | `draft-ietf-sidrops-aspa-profile-21` §§2–4 | `src/model/aspa.rs`, `src/validation/` | ASPA profile tests and synthetic VAP assertions |
+| BGPsec router-certificate profile checks | RFC 8209 §3 | `src/model/router_cert.rs`, `src/validation/` | router-certificate profile tests |
+| CMS signed-object profile | RFC 6488 §§2–3; RFC 9589 §4 | `src/model/signed_object.rs` | signed-object profile tests |
 | RRDP notification, snapshot, delta/replace/withdraw and fallback | RFC 8182 §§3.4–3.5 | `src/repository/sync/rrdp.rs`, `src/repository/sync/repo.rs` | snapshot/delta state-restart unit tests and synthetic Docker tests |
 | RRDP direct-reference and redirect origin checks | RFC 9674 §3.2 | `src/repository/fetch/http.rs`, `src/repository/sync/rrdp.rs` | cross-origin unit tests |
-| Repeated TAL/TA pairing and stable aggregate output | RFC 8630 §2; RFC 6813 data model | `src/cli/mod.rs`, `src/cli/validate.rs`, `src/runtime/` | CLI parser checks; locked multi-TAL E2E |
+| Repeated TAL/TA pairing and aggregate output | RFC 8630 §2 for each TAL; aggregation is an implementation choice | `src/cli/mod.rs`, `src/cli/validate.rs`, `src/runtime/` | CLI parser checks and multi-TAL integration evidence |
 | Bounded repository and object workers (default 8 each, shared across TALs) | operational support for the standard validation pipeline | `src/scheduler/`, `src/runtime/` | worker-pool unit tests |
 | Resumable RRDP protocol state | RFC 8182 §3.4 | `src/repository/storage/`, `src/repository/sync/rrdp.rs` | atomic state index and restart delta test |
 | CCR manifest, ROA, ASPA, trust-anchor and router-key states | `draft-ietf-sidrops-rpki-ccr-11` §§2–4 | `src/ccr/` | encode/decode tests and integration artifacts |
 | TA Constraints rule normalization and EE resource checks | `draft-ietf-sidrops-constraining-rpki-trust-anchors-01` §§3–4 | `src/ta_constraints.rs`, `src/validation/` | parser/normalization tests; constrained validation E2E |
 | VRP CSV output | RFC 6810 data semantics | `src/cli/validate.rs`, `src/runtime/` | self-contained Docker E2E CSV/summary assertions |
 
+References identify the implemented profiles, not a certification of complete
+RFC compliance. Draft revisions are intentionally explicit and are not claims
+of compatibility with later revisions. The CLI uses HTTPS RRDP, requires local
+TAL/TA pairs, and does not provide RTR or automatic TA-certificate refresh.
+CCR tests establish encoding and payload consistency, not independent
+revalidation of the entire trust chain by another relying party.
+
 The worker pool and interval index are implementation mechanisms, not new wire
 protocols; their tests must also prove deterministic output and unchanged
 validation decisions. Only the table entries above are in v0.1.0 scope.

docs/dependencies.md

@@ -0,0 +1,56 @@
+# Dependency maintenance
+
+Use the committed Cargo.lock. Do not run broad dependency updates as part of
+unrelated changes. Review runtime compatibility and licensing for each update.
+
+## Security audit
+
+```bash
+cargo install cargo-audit --locked --version 0.22.0
+cargo audit --json
+```
+
+The audit fetches the RustSec advisory database and needs network access. Record
+the tool version and database revision with release evidence. Database download
+failure is not a clean scan. Review informational warnings as well as errors;
+unresolved affected vulnerabilities block release. Cargo auditing does not scan
+Debian packages or fully establish the security of native bundled code.
+
+### Reviewed maintenance warning
+
+`serde_cbor 0.11.2` has the informational unmaintained advisory
+[RUSTSEC-2021-0127](https://rustsec.org/advisories/RUSTSEC-2021-0127.html).
+It remains used for persisted repository metadata. Replacing it needs a separate
+storage-compatibility review, not an untested codec substitution during release
+cleanup. The warning remains visible in audit output; no advisory is ignored.
+Operators should protect the state directory from untrusted modification.
+
+## License notices
+
+```bash
+python3 tools/dependency_notices.py --check
+# After a reviewed Cargo.lock change:
+python3 tools/dependency_notices.py
+```
+
+Requirements: Python 3, Cargo, curl, and HTTPS access to the Cargo registry and
+GitHub's raw file service. The tool reads the entire locked dependency graph,
+including build-time and other-platform dependencies, and preserves upstream
+license and notice text. `--check` does not modify tracked files.
+
+Some package archives omit their license file. `tools/license_supplements.json`
+records exact upstream commit URLs and SHA-256 checksums, derived from the
+package's `.cargo_vcs_info.json`. Version changes need a new source review;
+missing texts or checksum mismatches fail rather than silently omit attribution.
+Do not edit original copyright or license wording to match project formatting.
+
+## Coverage
+
+With cargo-llvm-cov and the toolchain's llvm-tools-preview component installed:
+
+```bash
+cargo llvm-cov --locked --all-targets --json --output-path target/coverage.json
+```
+
+Record actual line coverage and tool versions. The release target is 90%.
+Do not exclude production modules or change the denominator to meet the target.

docs/development.md

@@ -1,10 +1,12 @@
 # Development and testing
 
 Use Rust 1.92 or newer on Linux and the [native dependencies](getting-started.md).
-Tests additionally need Python 3, Python `cryptography`, and OpenSSL's CLI.
+Tests additionally need Python 3, Python `cryptography`, OpenSSL's CLI, and
+`ripgrep` (`rg`). Install them with `sudo apt-get install python3-cryptography openssl ripgrep`.
 
 ```bash
-cargo fmt --all --check
+python3 tools/check_format.py
+python3 -m unittest discover -s tools -p 'test_*.py'
 cargo check --locked --no-default-features
 cargo test --locked
 cargo clippy --locked --all-targets -- -D warnings
@@ -31,3 +33,10 @@ Generated keys and outputs are temporary and unsuitable as production inputs.
 Internal Rust modules are not a stable library API. The supported interface is
 the CLI and documented output files. Add behavior tests and update documentation
 when changing these interfaces.
+
+The format checker also checks files included through `include!`, which are not
+all traversed by `cargo fmt`. To format them, run `rustfmt --edition 2024` on
+the reported files, then rerun the checker. Preserve upstream license texts.
+
+For dependency and release checks see [Releasing](releasing.md) and
+[Dependency maintenance](dependencies.md).

docs/releasing.md

@@ -0,0 +1,37 @@
+# Release checklist
+
+This checklist does not publish packages or images automatically. Keep
+`publish = false` unless a separate crates.io publication decision is made.
+
+## Before the first public release
+
+- Confirm rights to publish all project code and preserve upstream attribution.
+- Establish the official public repository and enable and test GitHub Private
+  Vulnerability Reporting. Update [SECURITY.md](../SECURITY.md) with the real link.
+- Require CI checks on the protected main branch. Verify an actual successful
+  run on the hosting platform; local tests do not prove hosted CI is enabled.
+- Run the [development checks](development.md), dependency audit, license checks,
+  and coverage measurement from a clean candidate checkout. The line-coverage
+  target is 90%; record any shortfall as an unresolved release item, without
+  excluding production files to improve the number.
+- Review every security advisory. Fix affected dependencies with minimal
+  compatible changes, or block release. Do not silently suppress advisories.
+- Confirm no credentials, production inputs, repository state or internal
+  verification data are tracked. Check documentation commands and links.
+
+## Tag and artifacts
+
+After the checks pass, replace `Unreleased` with the release date, review the
+version and known limitations, and tag the exact tested commit. Rebuild source,
+binary and container artifacts from that commit. Publish SHA-256 checksums,
+build/toolchain details, dependency inventory (SBOM), and source revision with
+the artifacts. Include project and third-party licenses in binary distributions.
+
+Only Linux x86-64 has been validated for this candidate. Do not label other
+architectures or operating systems supported without testing them. Pin and
+record container base-image digests for the release build; mutable tags alone
+are not sufficient to reproduce an image.
+
+If runtime code or dependencies change, repeat end-to-end snapshot/delta and
+artifact verification. Documentation-only changes do not establish new runtime
+performance measurements; retain the revision associated with earlier results.

docs/third-party-licenses.txt

@@ -22157,7 +22157,7 @@ DEALINGS IN THE SOFTWARE.
 
 
 ========================================================================
-quick-xml 0.37.5 — LICENSE-MIT.md
+quick-xml 0.41.0 — LICENSE-MIT.md
 ========================================================================
 The MIT License (MIT)